This is the most critical risk. When a hacker modifies a Windows ISO to bypass activation, they have complete control over the file. It is trivially easy for them to inject a Remote Access Trojan (RAT), a keylogger, or spyware into the installation media.
Microsoft only distributes:
Many pre-activated ISOs contain slipped in by the uploader. Common payloads include:
2 ports USB printer sharing switch . Automatic/Iron shell windows 7 pre activated iso google drive